Insurers risk AI compliance crisis without data governance

As the FCA flags AI as a defining force by 2030, experts warn insurers are deploying AI before fixing the information foundations beneath it.

By Disrupts Editorial Team Tue, 4 August 2026

A brightly lit, modern control room features a multi-panel video wall displaying abstract blue shapes, a row of light wood desks with control panels, keyboards, mice, and chairs, and large windows revealing a city skyline.

Insurers rushing to automate underwriting, claims processing and customer service with artificial intelligence may be building on unstable ground, according to warnings from both the UK's Financial Conduct Authority and industry practitioners. The FCA has signalled that AI will be a defining force across financial services by 2030, but the regulator is equally clear that firms must keep pace on governance, not just deployment.

At the centre of the debate is a structural problem familiar to any organisation that has grown through legacy systems: information sprawl. Many insurers operate across disconnected silos of documents, claims data and customer records, spread across departments that have never been unified into a single governed layer. When AI is trained or prompted against that fragmented substrate, the risk is not that the AI performs poorly in isolation, it is that it systematises and accelerates existing data quality failures.

The governance gap behind the AI race

Yohan Lobo, Industry Solution Manager for Financial Services at M-Files, a document and knowledge management platform, argues that the sequencing has been inverted for much of the sector. "AI has enormous potential to transform the insurance industry, but people need to remember that AI doesn't create trust on its own," Lobo said. "If the information feeding AI systems is flawed, duplicated or lacks context, insurers risk making decisions that are difficult to explain, audit or defend."

The regulatory pressure point is explainability. Under the FCA's existing principles and evolving Consumer Duty framework, firms must be able to demonstrate how automated decisions are reached, particularly when those decisions affect policyholder outcomes. An AI underwriting model that draws on inconsistent or poorly audited data does not merely produce a wrong answer, it produces an answer that the firm cannot defend to a regulator or in litigation. Lobo frames this bluntly: "Compliance is no longer just about retaining documents or meeting reporting obligations. It's about ensuring that information is connected, governed and accessible so that every decision is explainable."

M-Files, which describes itself as a context-first document management system built on an enterprise knowledge graph, is positioning its platform as precisely the governed information layer that AI deployments require before they can meet regulatory standards. The company counts over 6,000 customers across more than 100 countries, with a Microsoft 365-native integration that targets enterprises already embedded in that stack.

Cross-sector read-across: governance as AI infrastructure

The insurance sector's information governance problem is not unique, but the regulatory stakes in financial services make it unusually acute. The same dynamic is playing out across healthcare, where AI-driven clinical decision support must be auditable under MHRA and NHS Digital frameworks, and in wealth management, where MiFID II-era suitability obligations are being stress-tested by automated advice tools.

For cross-sector investors watching the enterprise AI infrastructure stack, the underlying thesis is consistent: the value creation in agentic and decision-making AI does not sit solely with the model providers. It sits with whoever controls the governed, contextualised data layer those models reason against. That is why document and knowledge management vendors, traditionally a quiet corner of enterprise software, are attracting renewed attention from growth equity and strategic buyers. The FCA's 2030 signal gives that thesis a regulatory deadline, accelerating the urgency for insurers to resolve their governance architecture before enforcement action, rather than after.

For capital allocators with exposure to both fintech infrastructure and enterprise AI, the compliance risk narrative in insurance is a leading indicator. If regulators move first on explainability in financial services, the governance-layer build-out becomes a mandated spend category, and the firms that established it early acquire a durable competitive moat, while laggards face remediation costs that dwarf the original deployment investment.